subjects:
- kind: ServiceAccount
  name: {{ template "name" . }}
  namespace: {{ .Release.Namespace}}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ template "name" . }}-repair-role
{{- end }}
---
{{- if .Values.cni.ambient.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ template "name" . }}-ambient
  labels:

	args := map[string]any{
		"ServiceAccount": serviceAccountName,
		"Namespace":      clientNamespace.Name(),
	}

	role := `
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: allow-list-secrets
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - list
`

	rolebinding := `

  resourceNames: ["privileged"]
  verbs: ["use"]
{{- end }}
---
{{- if .Values.cni.repair.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "name" . }}-repair-role
  labels:
    app: {{ template "name" . }}
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    k8s-app: metrics-server
  name: metrics-server-auth-reader
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: extension-apiserver-authentication-reader
subjects:
- kind: ServiceAccount
  name: metrics-server
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:

      serviceAccountName: speaker
      terminationGracePeriodSeconds: 2
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
        operator: Exists
      - effect: NoSchedule
        key: node-role.kubernetes.io/control-plane
        operator: Exists
      volumes:
      - name: memberlist
        secret:
          defaultMode: 420

default install.operator.istio.io/owning-resource: unknown operator.istio.io/component: "Cni" rules: - apiGroups: [""] resources: - pods - nodes verbs: - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: istio-cni-repair-role labels: app: istio-cni release: istio istio.io/rev: default install.operator.istio.io/owning-resource: unknown operator.istio.io/component: "Cni" rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch", "delete", "patch", "update"...

  exit 1
fi

if [[ "${MODE}" == "ambient" ]]; then
  NUMNODES=${NUMNODES:-2}
fi

NODES=$(cat <<-EOM
nodes:
- role: control-plane
EOM
)

if [[ -n "${NUMNODES}" ]]; then
for _ in $(seq 1 "${NUMNODES}"); do
  NODES+=$(printf "\n%s" "- role: worker")
done
fi

CONFIG=$(cat <<-EOM
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
${FEATURES}
name: ${CLUSTERNAME}

func mustGetClusterRole(g *WithT, objs *ObjectSet, name string) *object.K8sObject {
	obj := objs.kind(name2.ClusterRoleStr).nameEquals(name)
	g.Expect(obj).Should(Not(BeNil()))
	return obj
}

// mustGetRole returns the role with the given name or fails if it's not found in objs.
func mustGetRole(g *WithT, objs *ObjectSet, name string) *object.K8sObject {
	obj := objs.kind(name2.RoleStr).nameEquals(name)
	g.Expect(obj).Should(Not(BeNil()))

  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}

	PodStr                            = "Pod"
	PDBStr                            = "PodDisruptionBudget"
	ReplicaSetStr                     = "ReplicaSet"
	RoleStr                           = "Role"
	RoleBindingStr                    = "RoleBinding"
	SAStr                             = "ServiceAccount"
	ServiceStr                        = "Service"
	SecretStr                         = "Secret"